Concierge privacy

Your choice

The concierge is an AI service provided through SIXBYY. It can help with published catalogue facts; answers may be wrong. It does not place orders, promise availability or provide medical advice. You can browse and contact the seller without using it.

When available, optional AI technologies and the conversation use your consent, Article 6(1)(a) GDPR. Accepting optional technologies does not start AI: use Start AI separately. Reject optional is equally available. Withdraw through Cookie settings; an active integration reloads and stops. Withdrawal does not undo earlier processing. Necessary security and abuse prevention use legitimate interests, Article 6(1)(f), to protect the service and its budget.

What the text service processes

Starting the concierge loads a script and embedded window from app.sixbyy.com. SIXBYY receives network/request information, including IP address, browser information, site origin, page path, language and an opaque conversation identifier. Do not put personal information in page URLs. A conversation handle in this site’s localStorage allows the conversation to resume; it is not an account login.

The text service uses your message, recent history and selected public product documents to answer. Only minimised, masked text may reach the model or persistent storage. This requirement covers messages, replies, history, session records, optional conversation archives and derived follow-up records, including names, contact fields, summaries and excerpts. Turning off archiving does not by itself disable session storage.

The concierge is for general product information. An enquiry or conversation is not an order or permission for marketing. Any separate seller follow-up must have a defined purpose and lawful basis before collection. Conversation records must not be used for model training, advertising or profiling under EcoWool’s instructions.

Health and other sensitive information

Please do not share health information, including personal allergies or medical history, or other sensitive details, identity documents or payment data. Ask about fibre composition and care in general terms.

For the service to be enabled, health-related fragments must be masked before any model request or persistent write; the original fragments must not be sent to a model or stored in messages, history, archives, follow-up records or logs. The service remains off until this protection is verified. Masking is data minimisation, not a claim that all remaining text is anonymous.

No Article 9 exception is relied on for this concierge. Ordinary AI/cookie consent is not explicit consent to process health data. If you believe sensitive information has been submitted, stop and email privacy@ecowool.ie with the approximate time and page, without repeating the sensitive text.

Voice

Visitor microphone access is disabled on this catalogue. The underlying SIXBYY widget has voice facilities, but this release does not activate them. Listening to a prerecorded podcast does not record your voice.

Any later voice activation needs a separate notice about audio, transcripts, suppliers, retention and transfers, plus a deliberate microphone action, a stop control and a text alternative. Voice is not automatically special-category biometric data; identification purposes or sensitive speech content can change the assessment.

Recipients and transfers

SIXBYY is a separate operator and acts as EcoWool’s data processor for the concierge platform under an Article 28 data processing agreement (DPA). The DPA must be completed and signed before activation; external subprocessors also require appropriate contracts and authorisation. Model providers act as authorised subprocessors; the intended text provider is OpenAI, with processing in the United States. No other model provider may be added without prior authorisation and an updated notice. The SIXBYY contracting identity and the actual hosting, support and backup recipients must be recorded privately before activation.

The agreed basis for transfers to providers in the United States is the European Commission’s Standard Contractual Clauses (SCCs), Decision (EU) 2021/914, under Article 46 GDPR, with supplementary measures. The applicable exporter/importer chain and signed or otherwise binding clauses, including completed annexes, must be verified before any transfer. Approval of SCCs by the owner does not itself execute a provider agreement. We do not promise EEA-only processing.

Required supplementary measures include minimisation and health-text masking before transfer or storage, encrypted transport and storage, restricted and confidential staff access, tenant and knowledge-source isolation, content-free operational logs, limited retention and tested deletion. A transfer assessment must address the actual countries, access and provider terms; encryption does not prevent a model provider from processing the permitted text in clear form. An unsafe transfer must not proceed.

Request the current recipient list and a copy of the applicable transfer safeguards at privacy@ecowool.ie; confidential information may be redacted. Provider retention and onward recipients must be checked for the selected account before activation. Zero provider retention is not promised.

SCC — Decision (EU) 2021/914

Storage and deletion

The approved retention period for concierge correspondence is 30 days after the last message in the conversation. EcoWool must use a 30-day setting; 30 days is also the required default. Session renewal, a retry or background maintenance must not restart this period.

At expiry, the messages and replies, stored conversation history, session records and identifiers, any transcript archives and their searchable copies/chunks, and conversation-derived follow-up contacts, summaries and excerpts must be deleted. This applies even when archiving is off. Copies must not be recreated by retries or a backup restore. No separate indefinite lead archive is authorised.

Backups and provider copies must be covered by a documented deletion schedule consistent with this 30-day rule before activation; routine backups must not extend it. If binding law requires a specific record to be kept longer, only that record may be isolated, access-restricted and retained for the legally required period, then deleted. This is not permission to retain the entire chat. An ordinary privacy notice or session expiry is not proof of deletion.

The site’s privacy choice lasts 180 days and is separate from the chat’s 30-day period. A local browser handle is not a transcript: the reviewed loader has no automatic client-side expiry for it, and it can be removed through browser storage settings. Server session expiry after inactivity is not deletion. Website logs and separately initiated email correspondence have different purposes and are described in the main Privacy Policy; raw chat and health fragments must not be copied into them.

Your rights

Email privacy@ecowool.ie to request access, correction, erasure, restriction or portability where applicable, or to object to legitimate-interest processing. You may withdraw consent at any time. We normally respond within one month; any permitted extension must be explained within that month. Provide only what is needed to locate the conversation; do not post its handle publicly.

You may complain to the Irish Data Protection Commission or your relevant EU supervisory authority. The concierge does not make decisions with legal or similarly significant effects. Rights and controller details are also in the main Privacy Policy and Seller sections.

Privacy Policy and Seller

Irish Data Protection Commission